Broccoli2Shell: Critical Brotli Flaw Now Exploited in the Wild
What you need to do
- Update Brotli to 1.0.10, 1.1.1 or 1.2.1, depending on the branch you run.
- Check runtimes and proxies that bundle Brotli, including Node.js, .NET, PowerShell, Bun, Envoy, Istio and the Python brotli and brotlicffi packages.
- If you cannot patch yet, stop affected services from decompressing Brotli content from untrusted sources.
Days after PHP2Shell, defenders are facing a second critical flaw in a building block of the modern web. The Canadian Centre for Cyber Security has issued alert AL26-027 for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder nicknamed "Broccoli2Shell." On Oct. 27 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities catalogue, which means attackers are already using it.
What the flaw does
Brotli is a compression format used to shrink web traffic and files. The vulnerable code sits in the decoder, the part that unpacks compressed data. An attacker can send specially crafted compressed data to an affected service without logging in. According to the Cyber Centre, successful exploitation can cause memory corruption, leak sensitive information, crash processes or allow arbitrary code execution.
Affected and fixed versions:
| Branch | Vulnerable | Fixed |
|---|---|---|
| 1.0.x | 1.0.3 up to 1.0.10 | 1.0.10 |
| 1.1.x | 1.1.0 up to 1.1.1 | 1.1.1 |
| 1.2.x | 1.2.0 up to 1.2.1 | 1.2.1 |
The dependency problem
As with PHP2Shell, the hard part is finding Brotli rather than patching it. The library is rarely installed on its own. It is bundled inside language runtimes, service meshes, reverse proxies and countless applications. The Cyber Centre specifically lists Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio and the Python brotli and brotlicffi packages among affected technologies.
That means an organization can be exposed through a container image, a vendor appliance or an internal tool it has not looked at in years. Software bill of materials (SBOM) data and dependency scanning tools are the fastest way to build an inventory. Teams without them should start with internet-facing services that accept compressed uploads or requests.
Mitigation while you wait for vendors
For systems that cannot be updated right away, the Cyber Centre recommends blocking affected applications from processing Brotli-compressed content from untrusted sources. It also advises watching for unexpected crashes or abnormal process behaviour, which can be an early sign of exploitation attempts against memory corruption bugs.
Organizations that rely on third-party products should contact suppliers now for patch timelines, especially for proxies and gateways that sit at the network edge.
